Sign in

AI data protection / Application security

Build with AI. Stay in control.

Steppa catches credentials and personal data before a prompt reaches an AI tool, tests your apps with authorized assessments, and turns every finding into a clear next step.

Open your workspace Watch the guard work
  • Checks run on your device
  • Authorized assessments only
  • Prompt bodies never stored

Works across the AI tools your team already uses

ChatGPT Claude Gemini Copilot Perplexity Mistral AI DeepSeek Grok Hugging Face Poe OpenRouter GitHub

LLM data guard

A second look before Send.

Steppa checks a prompt for sensitive details, applies your policy, and lets you review the result before anything is shared with an AI tool.

prompt.txtto · chatgpt.com
Help debug this deployment configuration:
OPENAI_API_KEY=sk-proj-R8x2mQ7vTp1LkDe4Nw9ZbYc5
Ping the on-call engineer at maya.ortiz@example.com
The service times out after 30 seconds.
Redact2 sensitive values replaced. Review before sending.
Synthetic example. Real prompts are checked locally and never stored.
Recorded demo · synthetic data
  1. 01ComposeWrite as usual in ChatGPT, Claude or Gemini.
  2. 02DetectKeys and personal data are flagged on your device.
  3. 03RedactYour policy masks each match automatically.
  4. 04ReviewYou approve the safe version before Send.

Authorized application assessments

From a signal to a clear next step.

Scope

Test with a clear scope.

Choose an approved target and an assessment depth. Strix runs it in its sandbox with your model provider, and only after you confirm you are allowed to test the target.

Target
app.example.com
Depth
Standard
Authorization
Confirmed

Validate

Evidence, not guesses.

Follow progress while findings are validated. Dependency versions are checked against OSV, and every finding carries the evidence behind it.

Illustrative progress. No live scan runs on this page.

Review

Know what to do next.

  • HighAccess controlReview evidence
  • MediumDependency advisoryUpdate package
  • LowSecurity headersCheck configuration

Sample findings. Your own results appear after you connect your workspace.

Privateby design

Your local prompt checks run on this device. The audit log keeps decisions and masked evidence, without retaining prompt bodies.

Application assessments use your configured model provider. Dependency checks send only the package name, ecosystem and version to OSV.

  1. 01

    Make it your workspace

    Confirm your identity, verify your inbox, and save your recovery key. Your existing project data stays in place.

  2. 02

    Connect what matters

    Pair the browser extension for prompt protection. Configure Strix and your model provider for assessments.

  3. 03

    Review. Improve. Repeat.

    Investigate findings, adjust protection policies, and test again to check your changes.

Before you get started

What can I use without a model API key?

Local prompt inspection, protection policies, local inventory discovery and the activity log work without a model API key. Dependency advisory checks use OSV. Automated pentests need a configured Strix runner and model provider.

Does signing in start a pentest?

No. You choose an approved target, select the assessment depth, confirm authorization, and start the assessment from the dashboard.

Can I use Google, GitHub or Microsoft?

Yes, once your workspace owner configures each provider. Microsoft sign-in supports personal accounts and work or school accounts. Invited addresses join as employees. Email and password sign-in always needs an inbox verification code.

What if I forget my password?

Use the recovery key shown when you created your account, together with a code sent to your registered inbox. Recovery signs out existing sessions and issues a replacement key.

Is this a shared cloud workspace?

The hosted pilot uses one company workspace. Administrators manage reports and policies; employees have limited accounts. Sensitive-content inspection stays on enrolled local devices.

Your next step

Open the workspace

Start with visibility. Move forward with context.

Workspace accessSecure session

Welcome to Steppa.

Connecting to your workspace…

Checking the service
Just looking? See the platform first

Protected by Steppa · runs locallyHow we handle your data